← All changes | includes/avada-widgets/property-brochures-link-shortcode.php +12 -4 2.2.3 → 2.4.0 View file →

		@@ -1,6 +1,11 @@
1	1	<?php
2	2
	3	+if ( ! defined( 'ABSPATH' ) ) {
	4	+ exit;
	5	+}
	6	+
	7	+
3	8	add_shortcode( 'avada_property_brochures_link', function( $atts ) {
4	9	$atts = shortcode_atts( array(
5	10	'content_align' => 'left',
6	11	'fusion_font_family_brochures_link_font' => '',
		@@ -9,9 +14,9 @@
9	14	'letter_spacing' => '',
10	15	'text_transform' => '',
11	16	'line_height' => '',
12	17	'text_color' => '',
13		- 'label' => '',
	18	+ 'label' => __( 'View Brochure', 'propertyhive' ),
14	19	), $atts );
15	20
16	21	if ( get_post_type( get_the_ID() ) != 'property' )
17	22	{
		@@ -23,8 +28,9 @@
23	28	global $property;
24	29
25	30	if ( empty($property) )
26	31	{
	32	+ // phpcs:ignore WordPress.NamingConventions.PrefixAllGlobals.NonPrefixedVariableFound -- Shared frontend property global used by the Avada shortcode contract; changing $property would break the existing property context passed to these widgets.
27	33	$property = new PH_Property(get_the_ID());
28	34	}
29	35
30	36	$style = Fusion_Builder_Element_Helper::get_font_styling( $atts, 'bedrooms_font' );
		@@ -53,12 +59,13 @@
53	59	if ( !is_array($brochure_urls) ) { $brochure_urls = array(); }
54	60
55	61	if ( !empty($brochure_urls) )
56	62	{
	63	+ // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- FusionBuilder::attributes() returns the complete HTML attribute fragment and escapes each attribute name and value.
57	64	echo '<div ' . FusionBuilder::attributes( 'property-brochures-link-shortcode' ) . '>';
58	65	foreach ( $brochure_urls as $brochure )
59	66	{
60		- echo '<a href="' . esc_url($brochure['url']) . '" target="_blank" rel="nofollow" style="' . $style . '">' . esc_html($label) . '</a>';
	67	+ echo '<a href="' . esc_url($brochure['url']) . '" target="_blank" rel="nofollow" style="' . esc_attr( safecss_filter_attr( $style ) ) . '">' . esc_html($atts['label']) . '</a>';
61	68	}
62	69	echo '</div>';
63	70	}
64	71	}
		@@ -67,12 +74,13 @@
67	74	$brochure_attachment_ids = $property->get_brochure_attachment_ids();
68	75
69	76	if ( !empty($brochure_attachment_ids) )
70	77	{
	78	+ // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- FusionBuilder::attributes() returns the complete HTML attribute fragment and escapes each attribute name and value.
71	79	echo '<div ' . FusionBuilder::attributes( 'property-brochures-link-shortcode' ) . '>';
72	80	foreach ( $brochure_attachment_ids as $attachment_id )
73	81	{
74		- echo '<a href="' . esc_url(wp_get_attachment_url($attachment_id)) . '" target="_blank" rel="nofollow" style="' . $style . '">' . esc_html($label) . '</a>';
	82	+ echo '<a href="' . esc_url(wp_get_attachment_url($attachment_id)) . '" target="_blank" rel="nofollow" style="' . esc_attr( safecss_filter_attr( $style ) ) . '">' . esc_html($atts['label']) . '</a>';
75	83	}
76	84	echo '</div>';
77	85	}
78	86	}
		@@ -81,5 +89,5 @@
81	89
82	90	fusion_element_rendering_elements( false );
83	91
84	92	return $html;
85		-});
	93	+});